CVE-2026-82520

parsedmarc before 11.0.1 is vulnerable to a Zip Bomb Denial of Service via compressed email attachments. The root cause is that parsedmarc decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incomin...

wheelaudit

wheelaudit ماسح أمان ملفات Python Wheel — افحص ملفات .whl بحثًا عن مشكلات أمنية قبل التثبيت. مدفوع بثغرات CVE حديثة في معالجة حزم Python: CVE-2026-24049 : اجتياز المسار في فك ضغط wheel يسمح بالتلاعب بصلاحيات ملفات النظام CVE-2026-1703 : اجتياز المسار عند تثبيت pip لأرشيفات wheel Google...

zip_bomb

ZIP Bomb Creator ZIP Bomb Creator est un outil permettant de créer un fichier ZIP de petite taille mais qui se décompresse de manière spectaculaire. Cela est utile pour les expériences de sécurité et pour tester les systèmes de fichiers contre les attaques de type ZIP Bomb. Fonctionnalités Créer...

CVE-2025-63914

CVE-2025-63914 CVE-2025-63914 के लिए सार्वजनिक प्रकटीकरण और पैच: Cinnamon/kotaemon में Zip bomb भेद्यता। श्रेय Wang Yuanrong सारांश mayextractzip फ़ंक्शन ZIP डीकंप्रेसन पर सीमाएं लागू करने में विफल रहता है, जिससे एक दुर्भावनापूर्ण ZIP बम अत्यधिक संसाधन खपत और सेवा अस्वीकार कर सकता है। विवरण...

CVE-2026-59274

Spring Integration is affected by an unbounded decompression flaw in the UnZipTransformer component, which does not limit decompressed entry size or entry count when processing zip archives. An attacker with low privileges can send a crafted zip archive (zip-bomb) over the network to exhaust JVM ...

CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration...

EUVD-2026-66212

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zipextractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded...

CVE-2026-80189

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zipextractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python2 (UTSA-2026-093150)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093150 advisory. Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service resource consumption via a ZIP bomb. Tenable has extracted the preceding...

CVE-2026-80189

LeafWiki 0.10.0 through 0.12.0 is vulnerable to uncontrolled resource consumption via unbounded ZIP extraction. The function ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go copies each decompressed entry with io.Copy without limiting output size. Although the upload is capped at 5...

PT-2026-81903

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploade...

cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS

cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS...

PT-2026-78483

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.1 Description The ZipArchiver::extract function in system/src/Grav/Common/Filesystem/ZipArchiver.php fails to enforce limits on uncompressed size, file count, or nesting depth when passing archives to...

Linux Distros Unpatched Vulnerability : CVE-2025-30153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema...

CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

CVE-2026-74046

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

GHSA-X768-8642-MMQ9 MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

EUVD-2026-61131

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can...

CVE-2026-68924 MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can...